tomevault-io Secure Code Review
When to use
Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.
Inputs to collect (if available)
- What component(s) are in scope (API, UI, worker, infra scripts)
- Data sensitivity (PII, auth/session, payments)
- Deployment assumptions (internet-facing, internal, multi-tenant)
- Any known incidents, CVEs, or audit requirements
Step-by-step process
- Map entry points & trust boundaries
- Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
- Identify where untrusted input crosses into privileged actions or sensitive sinks.
- Scan for high-risk classes
- Injection: SQL/NoSQL/LDAP/OS/template
- Authn/authz: missing checks, insecure defaults, confused deputy
- Deserialization & file handling: unsafe loads, path traversal, upload
- Crypto: homegrown crypto, weak randomness, token validation mistakes
- Logging: secrets/PII exposure, overly verbose errors
- SSRF: URL fetchers, webhook validation gaps
- Deep-dive the highest impact areas
- Trace data flow from input → validation → authorization → sink.
- Look for missing allow-lists, type confusion, and implicit conversions.
- Write findings in a consistent format
- Title, severity, confidence
- Where (file/function)
- Risk + prerequisites
- Repro steps
- Recommendation + verification steps
- Close with a remediation plan
- Quick wins (hours), medium fixes (days), structural guardrails (weeks).
Output template
Summary
- Scope reviewed:
- Top issues:
- Overall risk: Low / Medium / High / Critical
Findings (repeat)
- Title
- Severity / Confidence
- Where
- Risk
- Repro
- Recommendation
- Verification
Repo integration (optional)
If this repo includes prompt files under /prompts, the following are commonly relevant:
secure-code-review.prompt.mdscan-for-insecure-apis.prompt.mdvalidate-input-handling.prompt.mdreview-auth-flows.prompt.md
Converted and distributed by TomeVault — claim your Tome and manage your conversions.